1. Who processes your data
BnB Attitude is the sole proprietorship of Tom Pronk, advising short-term rental hosts on pricing strategy, listing optimisation and revenue management. For the data processed through this website, BnB Attitude is the data controller under the EU General Data Protection Regulation (GDPR).
Because the business is established in the Netherlands, the GDPR applies to this website regardless of where you are located. No data protection officer has been appointed, which is not required for an organisation of this size and these types of processing. Privacy questions can be sent to the email address above.
2. Cookies and browser storage
This website places no cookies. There are no analytics, advertising pixels, social media trackers or A/B testing tools on bnbattitude.com. The site stores one item in your browser, described below, and nothing else.
Under the GDPR and the ePrivacy rules, consent is required before information is stored on or read from your device, unless that storage is strictly necessary for a service you requested yourself.
| Name | Type | Purpose | Lifetime |
|---|
| bnba-locale-pref |
Local storage, set by this website |
Records that you switched to another language version or dismissed the language suggestion, so the suggestion is not shown again |
Until you clear your browser storage |
This item is only written when you click the switch or the dismiss button in the language banner. Browsing the site without clicking it stores nothing. It contains a single word, holds no identifier and is never sent to a server, which is why it is exempt from the consent requirement and why there is no cookie banner on this site.
Other information is still recorded elsewhere. Requesting a page writes technical information to the hosting provider's log files, and submitting the contact form sends data to an external processor. Those two are covered in sections 3 and 4.
If cookies are added later
If visitor analytics, a chat widget, a scheduling tool or similar functionality that does use cookies is added to the site, a consent notice will be added and this statement will list each cookie with its name, purpose, lifetime and the party setting it.
3. The contact form
The contact page has a form for requesting a free listing scan. What you enter there arrives in my mailbox.
| Field | Required | Purpose |
|---|
| Name | Yes | Addressing you in the reply |
| Email address | Yes | Responding to your request |
| Listing URL | Yes | Analysing the listing for the scan |
| Number of properties | Yes | Assessing which service fits |
| Phone number | No | Calling or scheduling a call if you prefer that |
| Message | No | Context for your request |
Legal basis. The processing is necessary to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). You fill in the form yourself and decide what to put in it.
Processor. The form runs through Formspree, Inc., a US service that receives the message and forwards it to my mailbox. Formspree also processes your IP address and the time of submission for spam filtering. See sections 9 and 10.
Spam controls. The form contains a hidden field and a timing check to block automated submissions. Neither involves any personal data of yours and neither stores anything on your device.
Your request is not used for a newsletter or a mailing list. If you would rather not hear from me after the first contact, one email saying so is enough.
4. Server logs and hosting
This website runs on Vercel Inc. Like any web server, Vercel records technical data when a page is requested: your IP address, the time, the requested URL, the HTTP status code, your browser and operating system, and the page you came from.
Legal basis. Legitimate interest (Article 6(1)(f) GDPR): keeping the site working, investigating faults, and countering abuse such as attacks and bot traffic. These logs are not used to profile visitors or to link visits to individual people.
5. Google Fonts
The pages use the Plus Jakarta Sans typeface, loaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com). Loading it means Google receives your IP address and information about your browser. Loading a typeface does not set a cookie.
Legal basis. Legitimate interest (Article 6(1)(f) GDPR): consistent and legible rendering of the site. If you would rather avoid this, you can block external resources in your browser, and the site will continue to work with a default typeface.
6. Email, phone and LinkedIn
If you contact me directly by email, phone, WhatsApp or LinkedIn, I process the data you provide: your name, your contact details and the content of your message. This is done to answer your question, on the basis of the same pre-contractual interest or of an existing agreement.
Email runs through the mail provider connected to the bnbattitude.nl domain. Messages sent via LinkedIn and WhatsApp sit on those platforms' servers, where their own privacy terms apply.
7. Client data
If you become a client, I additionally process data needed to carry out the engagement: name and contact details, invoicing and payment details, revenue and booking data from your rentals, and access to rental platforms and pricing tools insofar as you provide it. This is done on the basis of the agreement and, for invoicing, on the basis of the statutory record-keeping obligation.
Client revenue and booking data is not shared with third parties and is not used in an identifiable form in publications, presentations or sample dashboards.
8. Retention periods
| Data | Retention | Reason |
|---|
| Contact form request with no follow-up | 12 months | Being able to look back if the same person asks again later |
| Email correspondence with prospects | 12 months after the last contact | Continuity of the conversation |
| Client data | Up to 2 years after the agreement ends | Terms of engagement |
| Invoices and accounting records | 7 years | Dutch statutory tax retention period |
| Server logs at the hosting provider | Per Vercel's retention policy, in the order of weeks | Fault investigation and abuse prevention |
9. Who receives your data
Your data is not sold and is not used for third-party advertising. I do use service providers who process data as processors on my instructions.
| Party | Role | What they receive |
|---|
| Vercel Inc. | Website hosting | Visitor IP addresses and technical log data |
| Formspree, Inc. | Contact form handling | Everything you enter in the form, plus IP address and timestamp |
| Google Ireland Ltd. and Google LLC | Typeface delivery | IP address and browser data when the page loads |
| The mail provider for bnbattitude.nl | Sending and storing email | Content and metadata of email correspondence |
Data is also provided to my accountant and to the Dutch tax authorities insofar as required for bookkeeping and tax returns, and to other parties where a legal obligation requires it.
10. Transfers outside the EU
Formspree, Vercel and Google are US companies. Using their services may involve processing on servers outside the European Economic Area. Those transfers rely on the EU-US Data Privacy Framework where the party in question is certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission.
If you want to know which basis applies to a specific party, send an email and I will look it up for you.
11. Security
The website is served over HTTPS only, so traffic between your browser and the server is encrypted. Accounts used to access client data are protected with two-factor authentication. Access to clients' rental platforms and pricing tools runs through a separate user account with limited permissions wherever possible.
If you suspect something is wrong with the security of this website or of data I process, report it by email. I respond to such reports and fix what can be fixed.
12. Your rights
Under the GDPR you have the following rights regarding your personal data:
- Access. Request which data about you is being processed.
- Rectification. Have incorrect or incomplete data corrected or completed.
- Erasure. Have your data deleted, unless a statutory retention obligation such as the tax retention period prevents it.
- Restriction. Have processing paused, for example while the accuracy of data is being checked.
- Objection. Object to processing based on legitimate interest, such as the server logs.
- Portability. Receive the data you provided yourself in a common file format.
- Withdrawing consent. Where you gave consent for something, you may withdraw it at any time, without that affecting the lawfulness of processing carried out beforehand.
Send a request to tom [at] bnbattitude.nl. You will get an answer within one month. To prevent data ending up with the wrong person, I may ask for additional information showing that the request comes from you. There is no charge for a request.
13. Filing a complaint
If you disagree with how your data is handled, let me know by email first and I will look into it. You also always have the right to lodge a complaint with a supervisory authority. For BnB Attitude that is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, the Netherlands, telephone +31 88 1805 250, autoriteitpersoonsgegevens.nl. If you live in another EU or EEA country, you may also complain to the supervisory authority there.
14. Changes
This statement is updated whenever the website or the way I work changes, for example if an analytics tool or a scheduling tool is added. The version number and the month of the last change are shown at the top of the page. The version published at any given moment is the one that applies.